4

We have an internet-facing, SharePoint 2010, Publishing Site. The content authors that maintain the site are JavaScript savvy web designers. They would like to be able to add JavaScript to publishing pages when editing them. However, we've noticed that RichHtmlField control is stripping out <script> tags, apparently to prevent JavaScript injection attacks. Because the content authors are experienced with JavaScript, we are not worried about them inadvertently opening us up to JavaScript injection attacks.

What are some approaches to allow content authors to add arbitrary JavaScript to a publishing page?

Thanks!

  • I have work around for this. Just couple of days I tried this in SharePoint 2007 using RichHtmlField. I just customized the RichHtmlField and it was successfully working. Ofcourse, as per your requirement some code changes would require but we have solution. If you need any technical help or coding help, please contact me on Anand.Thurubatla@gmail.com Thanks, Anand – user630119 Jul 12 '11 at 9:51
3

It depends. If you want to add JavaScript to specific publishing pages, then the ContentEditor web part is a good choice.

Alternatively, SharePoint Designer is a good way of doing this too. It would allow you to edit the page layouts - adding JavaScript to all pages using that layout. Alternatively you can 'disconnect' a publishing page from it's layout, and edit it singly.

See https://stackoverflow.com/questions/3628779/how-to-allow-using-javascript-in-richhtmlfield-control also

4

One approach, as an alternative to your RichHtmlField, and short of them having access to editing the entire page, is to use a ContentEditor Web Part. You can put your Javascript in here and not have it stripped out.

1

This approach has worked for me now on a few SharePoint public website projects:

  • Create a Note field called JavaScriptToInject
  • Add this field to my Publishing content type
  • Add the field to an edit panel of my Publishing page layout, allowing the users to edit the value when the page is in edit mode
  • Create a simple field control that checks for this field and writes its contents out to the browser
  • Put the field control in the head section of your master page

I find this approach very useful when I need to have a one-off script run for a particular page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.